Hamming Masks: Toward defending constrained networked systems

The ability of intrusion detection systems to identify anomalous behavior successfully has lagged behind their ability to recognize activity based on signatures. Anomaly detection techniques for enterprises typically use statistical traffic models to accommodate varying network traffic profiles and limit the volume of false alerts. We offer a set of characteristics to identify constrained networked systems in which we hypothesize that anomaly detection techniques are well suited and useful. We offer a specific, concrete approach, Hamming Masks, for identifying expected behavior in a constrained networked system and recognizing unexpected behavior. We demonstrate the applicability of Hamming Masks for two different data sets and find that the distinctions between the enterprise data set and the constrained networked system data set are large.